diff -u -r a/sys/dev/netif/ral/rt2860.c b/sys/dev/netif/ral/rt2860.c
--- a/sys/dev/netif/ral/rt2860.c	2026-09-16 01:15:24.309181460 +0000
+++ b/sys/dev/netif/ral/rt2860.c	2026-09-16 01:15:56.908770090 +0000
@@ -1574,6 +1574,10 @@
 	}
 	ring = &sc->txq[qid];
 	ridx = ieee80211_legacy_rate_lookup(ic->ic_rt, rate);
+	if (ridx == (uint8_t)-1) {	/* rate not in the table (DF-3753) */
+		m_freem(m);
+		return EINVAL;
+	}
 
 	/* get MCS code from rate index */
 	mcs = rt2860_rates[ridx].mcs;
@@ -2350,7 +2354,7 @@
 {
 	struct ieee80211com *ic = &sc->sc_ic;
 	uint32_t mask = 0;
-	uint8_t rate;
+	uint8_t rate, ridx;
 	int i;
 
 	for (i = 0; i < rs->rs_nrates; i++) {
@@ -2359,8 +2363,10 @@
 		if (!(rate & IEEE80211_RATE_BASIC))
 			continue;
 
-		mask |= 1 << ieee80211_legacy_rate_lookup(ic->ic_rt,
+		ridx = ieee80211_legacy_rate_lookup(ic->ic_rt,
 		    IEEE80211_RV(rate));
+		if (ridx != (uint8_t)-1)	/* DF-3753: skip unknown rates */
+			mask |= 1 << ridx;
 	}
 
 	RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, mask);